Alternatively - a backdoor without any authentication requirements at all was discovered.

There have been times when web crawlers have found pages with delete icons on them that are pointing to GET requests and, after dutifully following them to index the data, resulted in a server being wiped.